Previous to El Capitan one could use pfctl and /etc/pf.conf to "trap" the ip addresses of sites attempting to break into a server using brute force attacks producing 100's of attempts per second. The rules one created would put the offending ip addresses into an "attackers" table and then reject any connection attempts from that ip address.
With El Capitan, all port connections appear to be handled first by launchd and now the pfctl method has no effect.
Does anyone know how to adapt the pfctl approach to this new connection logic? The automatic detection rules were really effective.